719 lines
27 KiB
YAML
719 lines
27 KiB
YAML
name: build-packages
|
|
|
|
# Trigger philosophy
|
|
# - Any push to any branch + any PR -> run the build matrix so CI is
|
|
# always testable. Same-repo PR runs own package validation; matching
|
|
# branch push runs become a lightweight mirror only after a current
|
|
# open PR run for the same commit is visible. If lookup is slow or
|
|
# unavailable, the push run falls back to the full matrix. Artifacts
|
|
# upload as workflow artifacts only; *no* GitHub Release is published.
|
|
# - Tag push matching `v<MAJOR>.<MINOR>.<PATCH>` (with optional
|
|
# pre-release suffix like `v1.2.3-rc.1`) -> run the matrix and
|
|
# publish a GitHub Release. Loose tags like `v-test`, `vNEXT`, or
|
|
# `v1.0` no longer auto-publish.
|
|
# - Manual `workflow_dispatch` -> run the matrix on the selected ref.
|
|
# `publish_release` only publishes when the selected ref is also a
|
|
# strict version tag.
|
|
#
|
|
# The release job validates the exact same rule before publishing, so
|
|
# adding branches/PRs above is safe; accidental tag-like branch names
|
|
# won't leak a release.
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
publish_release:
|
|
description: "Publish GitHub Release after build"
|
|
type: boolean
|
|
default: false
|
|
mosh_bin_release:
|
|
description: "Release tag containing bundled mosh-client binaries"
|
|
type: string
|
|
default: ""
|
|
et_bin_release:
|
|
description: "Release tag containing bundled et (EternalTerminal) binaries"
|
|
type: string
|
|
default: ""
|
|
push:
|
|
branches:
|
|
- "**"
|
|
tags:
|
|
- "v[0-9]+.[0-9]+.[0-9]+"
|
|
- "v[0-9]+.[0-9]+.[0-9]+-[0-9A-Za-z]*"
|
|
pull_request:
|
|
|
|
# A newer run for the same push branch or PR cancels older in-progress
|
|
# work. Push and PR events stay in separate groups so deduped push runs
|
|
# can mirror PR results cleanly instead of leaving cancelled checks on
|
|
# the PR. Publishing tag runs share a release group across push and
|
|
# manual dispatch; non-publishing manual tag runs use their own group.
|
|
concurrency:
|
|
group: build-packages-${{ github.workflow }}-${{ startsWith(github.ref, 'refs/tags/') && (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.publish_release)) && 'release' || github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.ref_type }}-${{ github.event.pull_request.head.ref || github.ref_name }}
|
|
cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }}
|
|
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
pull-requests: read
|
|
|
|
env:
|
|
MOSH_BIN_RELEASE: ${{ github.event.inputs.mosh_bin_release || vars.MOSH_BIN_RELEASE || '' }}
|
|
BUNDLE_MOSH: ${{ (startsWith(github.ref, 'refs/tags/v') && (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.publish_release))) || (github.event_name == 'workflow_dispatch' && inputs.mosh_bin_release != '') }}
|
|
ET_BIN_RELEASE: ${{ github.event.inputs.et_bin_release || vars.ET_BIN_RELEASE || '' }}
|
|
BUNDLE_ET: ${{ (startsWith(github.ref, 'refs/tags/v') && (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.publish_release))) || (github.event_name == 'workflow_dispatch' && inputs.et_bin_release != '') }}
|
|
STRICT_VERSION_REF_RE: '^refs/tags/v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-((0|[1-9][0-9]*|[A-Za-z][0-9A-Za-z-]*|[0-9A-Za-z][0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*)(\.(0|[1-9][0-9]*|[A-Za-z][0-9A-Za-z-]*|[0-9A-Za-z][0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*))*))?$'
|
|
|
|
jobs:
|
|
dedupe:
|
|
name: dedupe push run
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
skip_heavy_ci: ${{ steps.detect.outputs.skip_heavy_ci }}
|
|
heavy_ci_pr_run_id: ${{ steps.detect.outputs.heavy_ci_pr_run_id }}
|
|
steps:
|
|
- name: Detect duplicate heavy CI
|
|
id: detect
|
|
shell: bash
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
REPOSITORY: ${{ github.repository }}
|
|
REPOSITORY_OWNER: ${{ github.repository_owner }}
|
|
EVENT_NAME: ${{ github.event_name }}
|
|
REF: ${{ github.ref }}
|
|
HEAD_REF: ${{ github.ref_name }}
|
|
HEAD_SHA: ${{ github.sha }}
|
|
run: |
|
|
skip_heavy_ci=false
|
|
if [[ "$EVENT_NAME" == "push" && "$REF" == refs/heads/* ]]; then
|
|
pr_count=0
|
|
if ! pr_count="$(gh api --method GET "repos/${REPOSITORY}/pulls" \
|
|
-f state=open \
|
|
-f "head=${REPOSITORY_OWNER}:${HEAD_REF}" \
|
|
-F per_page=1 \
|
|
--jq 'length')"; then
|
|
echo "::warning::Could not check open PRs; running full push CI."
|
|
pr_count=0
|
|
fi
|
|
|
|
pr_run_id=""
|
|
if [[ "$pr_count" != "0" ]]; then
|
|
cutoff="$(date -u -d '20 minutes ago' +'%Y-%m-%dT%H:%M:%SZ')"
|
|
for attempt in {1..18}; do
|
|
if ! pr_run_id="$(gh api --method GET "repos/${REPOSITORY}/actions/workflows/build.yml/runs" \
|
|
-f event=pull_request \
|
|
-f "branch=${HEAD_REF}" \
|
|
-f "head_sha=${HEAD_SHA}" \
|
|
-F per_page=20 \
|
|
--jq "[.workflow_runs[] | select(.created_at >= \"${cutoff}\" and .conclusion != \"cancelled\" and .conclusion != \"skipped\")] | sort_by(.created_at, .id) | .[0].id // \"\"")"; then
|
|
echo "::warning::Could not check PR workflow runs; running full push CI."
|
|
pr_run_id=""
|
|
break
|
|
fi
|
|
if [[ -n "$pr_run_id" ]]; then
|
|
skip_heavy_ci=true
|
|
break
|
|
fi
|
|
if [[ "$attempt" == "18" ]]; then
|
|
break
|
|
fi
|
|
sleep 10
|
|
done
|
|
fi
|
|
if [[ -n "$pr_run_id" ]]; then
|
|
echo "heavy_ci_pr_run_id=${pr_run_id}" >> "$GITHUB_OUTPUT"
|
|
echo "heavy_ci_pr_run_id=${pr_run_id}"
|
|
fi
|
|
fi
|
|
echo "skip_heavy_ci=${skip_heavy_ci}" >> "$GITHUB_OUTPUT"
|
|
echo "skip_heavy_ci=${skip_heavy_ci}"
|
|
|
|
dedupe-result:
|
|
name: dedupe result
|
|
needs: dedupe
|
|
if: needs.dedupe.outputs.skip_heavy_ci == 'true'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Mirror PR build result
|
|
shell: bash
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
REPOSITORY: ${{ github.repository }}
|
|
PR_RUN_ID: ${{ needs.dedupe.outputs.heavy_ci_pr_run_id }}
|
|
run: |
|
|
if [[ -z "$PR_RUN_ID" ]]; then
|
|
echo "::error::No PR workflow run was selected for dedupe."
|
|
exit 1
|
|
fi
|
|
|
|
for attempt in {1..360}; do
|
|
if ! result="$(gh run view "$PR_RUN_ID" --repo "$REPOSITORY" --json status,conclusion --jq '.status + "|" + (.conclusion // "")')"; then
|
|
echo "::warning::Could not read PR workflow run ${PR_RUN_ID}; retrying."
|
|
sleep 30
|
|
continue
|
|
fi
|
|
status="${result%%|*}"
|
|
conclusion="${result#*|}"
|
|
echo "PR run ${PR_RUN_ID}: status=${status} conclusion=${conclusion:-pending}"
|
|
|
|
if [[ "$status" == "completed" ]]; then
|
|
if [[ "$conclusion" == "success" ]]; then
|
|
exit 0
|
|
fi
|
|
echo "::error::PR workflow run ${PR_RUN_ID} completed with conclusion '${conclusion}'."
|
|
exit 1
|
|
fi
|
|
|
|
sleep 30
|
|
done
|
|
|
|
echo "::error::Timed out waiting for PR workflow run ${PR_RUN_ID}."
|
|
exit 1
|
|
|
|
resolve-mosh:
|
|
name: resolve bundled mosh-client
|
|
needs: dedupe
|
|
if: |
|
|
needs.dedupe.outputs.skip_heavy_ci != 'true'
|
|
&& (
|
|
(startsWith(github.ref, 'refs/tags/v') && (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.publish_release)))
|
|
|| (github.event_name == 'workflow_dispatch' && inputs.mosh_bin_release != '')
|
|
)
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
mosh_bin_release: ${{ steps.resolve.outputs.mosh_bin_release }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Resolve bundled mosh-client release
|
|
id: resolve
|
|
env:
|
|
GITHUB_TOKEN: ${{ github.token }}
|
|
run: |
|
|
node scripts/resolve-mosh-bin-release.cjs
|
|
release="$(grep '^MOSH_BIN_RELEASE=' "$GITHUB_ENV" | tail -n 1 | cut -d= -f2-)"
|
|
if [[ -z "$release" ]]; then
|
|
echo "::error::MOSH_BIN_RELEASE was not resolved."
|
|
exit 1
|
|
fi
|
|
echo "mosh_bin_release=${release}" >> "$GITHUB_OUTPUT"
|
|
|
|
resolve-et:
|
|
name: resolve bundled et-client
|
|
needs: dedupe
|
|
if: |
|
|
needs.dedupe.outputs.skip_heavy_ci != 'true'
|
|
&& (
|
|
(startsWith(github.ref, 'refs/tags/v') && (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.publish_release)))
|
|
|| (github.event_name == 'workflow_dispatch' && inputs.et_bin_release != '')
|
|
)
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
et_bin_release: ${{ steps.resolve.outputs.et_bin_release }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Resolve bundled et-client release
|
|
id: resolve
|
|
env:
|
|
GITHUB_TOKEN: ${{ github.token }}
|
|
run: |
|
|
node scripts/resolve-et-bin-release.cjs
|
|
release="$(grep '^ET_BIN_RELEASE=' "$GITHUB_ENV" | tail -n 1 | cut -d= -f2-)"
|
|
if [[ -z "$release" ]]; then
|
|
echo "::error::ET_BIN_RELEASE was not resolved."
|
|
exit 1
|
|
fi
|
|
echo "et_bin_release=${release}" >> "$GITHUB_OUTPUT"
|
|
|
|
build:
|
|
name: ${{ needs.dedupe.outputs.skip_heavy_ci == 'true' && format('deduped build-{0}', matrix.name) || format('build-{0}', matrix.name) }}
|
|
needs: [dedupe, resolve-mosh, resolve-et]
|
|
if: |
|
|
always()
|
|
&& needs.dedupe.result == 'success'
|
|
&& needs.dedupe.outputs.skip_heavy_ci != 'true'
|
|
runs-on: ${{ matrix.os }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- name: macos
|
|
os: macos-latest
|
|
pack_script: pack:mac
|
|
- name: windows
|
|
os: windows-latest
|
|
# The mosh binary workflow currently produces win32-x64 only.
|
|
# Keep official packages aligned with bundled-mosh coverage
|
|
# until Cygwin arm64 is stable enough to build win32-arm64.
|
|
pack_script: pack:win-x64
|
|
env:
|
|
MOSH_BIN_RELEASE: ${{ needs.resolve-mosh.outputs.mosh_bin_release }}
|
|
ET_BIN_RELEASE: ${{ needs.resolve-et.outputs.et_bin_release }}
|
|
VITE_SYNC_GITHUB_CLIENT_ID: ${{ secrets.VITE_SYNC_GITHUB_CLIENT_ID }}
|
|
VITE_SYNC_GOOGLE_CLIENT_ID: ${{ secrets.VITE_SYNC_GOOGLE_CLIENT_ID }}
|
|
VITE_SYNC_GOOGLE_CLIENT_SECRET: ${{ secrets.VITE_SYNC_GOOGLE_CLIENT_SECRET }}
|
|
VITE_SYNC_ONEDRIVE_CLIENT_ID: ${{ secrets.VITE_SYNC_ONEDRIVE_CLIENT_ID }}
|
|
steps:
|
|
- name: Validate bundled mosh-client release
|
|
if: env.BUNDLE_MOSH == 'true'
|
|
shell: bash
|
|
env:
|
|
RESOLVE_MOSH_RESULT: ${{ needs.resolve-mosh.result }}
|
|
run: |
|
|
if [[ "$RESOLVE_MOSH_RESULT" != "success" || -z "$MOSH_BIN_RELEASE" ]]; then
|
|
echo "::error::Bundled mosh-client release was not resolved for this package build."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Validate bundled et-client release
|
|
if: env.BUNDLE_ET == 'true'
|
|
shell: bash
|
|
env:
|
|
RESOLVE_ET_RESULT: ${{ needs.resolve-et.result }}
|
|
run: |
|
|
if [[ "$RESOLVE_ET_RESULT" != "success" || -z "$ET_BIN_RELEASE" ]]; then
|
|
echo "::error::Bundled et-client release was not resolved for this package build."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Node
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
|
|
- name: Install deps
|
|
run: npm ci
|
|
|
|
- name: Fetch bundled mosh-client
|
|
if: env.BUNDLE_MOSH == 'true'
|
|
shell: bash
|
|
run: |
|
|
if [[ "${{ matrix.name }}" == "macos" ]]; then
|
|
npm run fetch:mosh -- --platform=darwin --arch=universal
|
|
elif [[ "${{ matrix.name }}" == "windows" ]]; then
|
|
npm run fetch:mosh -- --platform=win32 --arch=x64
|
|
fi
|
|
|
|
- name: Fetch bundled et-client
|
|
if: env.BUNDLE_ET == 'true'
|
|
shell: bash
|
|
run: |
|
|
if [[ "${{ matrix.name }}" == "macos" ]]; then
|
|
npm run fetch:et -- --platform=darwin --arch=universal
|
|
elif [[ "${{ matrix.name }}" == "windows" ]]; then
|
|
npm run fetch:et -- --platform=win32 --arch=x64
|
|
fi
|
|
|
|
- name: Set version
|
|
shell: bash
|
|
run: |
|
|
# Strict semver matches v<MAJOR>.<MINOR>.<PATCH>[-pre]; loose
|
|
# tags / branches / PRs fall through to a semver-pre-release
|
|
# form (`0.0.0-sha-<short-sha>`) so npm pkg / electron-builder
|
|
# accept it. Non-semver versions (e.g. bare "abc1234") cause
|
|
# downstream tooling to error or pick weird codepaths.
|
|
if [[ "$GITHUB_REF" =~ $STRICT_VERSION_REF_RE ]]; then
|
|
VERSION="${GITHUB_REF_NAME#v}"
|
|
else
|
|
VERSION="0.0.0-sha-${GITHUB_SHA:0:7}"
|
|
fi
|
|
echo "Setting version to ${VERSION}"
|
|
npm pkg set version="${VERSION}"
|
|
|
|
- name: Build package
|
|
env:
|
|
ELECTRON_BUILDER_PUBLISH: "never"
|
|
# macOS code signing & notarization (only for macOS builds)
|
|
CSC_LINK: ${{ matrix.name == 'macos' && secrets.MAC_CSC_LINK || '' }}
|
|
CSC_KEY_PASSWORD: ${{ matrix.name == 'macos' && secrets.MAC_CSC_KEY_PASSWORD || '' }}
|
|
APPLE_ID: ${{ matrix.name == 'macos' && secrets.APPLE_ID || '' }}
|
|
APPLE_APP_SPECIFIC_PASSWORD: ${{ matrix.name == 'macos' && secrets.APPLE_APP_SPECIFIC_PASSWORD || '' }}
|
|
APPLE_TEAM_ID: ${{ matrix.name == 'macos' && secrets.APPLE_TEAM_ID || '' }}
|
|
run: npm run ${{ matrix.pack_script }}
|
|
|
|
- name: Upload artifacts
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: netcatty-${{ matrix.name }}
|
|
path: |
|
|
release/*.dmg
|
|
release/*.zip
|
|
release/*.exe
|
|
release/*.msi
|
|
release/*.AppImage
|
|
release/*.deb
|
|
release/*.rpm
|
|
release/*.pacman
|
|
release/*.tar.gz
|
|
release/*.yml
|
|
release/*.blockmap
|
|
if-no-files-found: ignore
|
|
|
|
# Linux x64 — pin to ubuntu-22.04 for broader glibc compatibility.
|
|
# ubuntu-latest (24.04) links native modules against glibc 2.39 which
|
|
# can cause dlopen failures on some distros. 22.04 uses glibc 2.35,
|
|
# compatible with most current Linux distributions including Arch.
|
|
# See #264.
|
|
build-linux-x64:
|
|
name: ${{ needs.dedupe.outputs.skip_heavy_ci == 'true' && 'deduped build-linux-x64' || 'build-linux-x64' }}
|
|
needs: [dedupe, resolve-mosh, resolve-et]
|
|
if: |
|
|
always()
|
|
&& needs.dedupe.result == 'success'
|
|
&& needs.dedupe.outputs.skip_heavy_ci != 'true'
|
|
runs-on: ubuntu-22.04
|
|
env:
|
|
MOSH_BIN_RELEASE: ${{ needs.resolve-mosh.outputs.mosh_bin_release }}
|
|
ET_BIN_RELEASE: ${{ needs.resolve-et.outputs.et_bin_release }}
|
|
npm_config_arch: x64
|
|
npm_config_target_arch: x64
|
|
VITE_SYNC_GITHUB_CLIENT_ID: ${{ secrets.VITE_SYNC_GITHUB_CLIENT_ID }}
|
|
VITE_SYNC_GOOGLE_CLIENT_ID: ${{ secrets.VITE_SYNC_GOOGLE_CLIENT_ID }}
|
|
VITE_SYNC_GOOGLE_CLIENT_SECRET: ${{ secrets.VITE_SYNC_GOOGLE_CLIENT_SECRET }}
|
|
VITE_SYNC_ONEDRIVE_CLIENT_ID: ${{ secrets.VITE_SYNC_ONEDRIVE_CLIENT_ID }}
|
|
steps:
|
|
- name: Validate bundled mosh-client release
|
|
if: env.BUNDLE_MOSH == 'true'
|
|
shell: bash
|
|
env:
|
|
RESOLVE_MOSH_RESULT: ${{ needs.resolve-mosh.result }}
|
|
run: |
|
|
if [[ "$RESOLVE_MOSH_RESULT" != "success" || -z "$MOSH_BIN_RELEASE" ]]; then
|
|
echo "::error::Bundled mosh-client release was not resolved for this package build."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Validate bundled et-client release
|
|
if: env.BUNDLE_ET == 'true'
|
|
shell: bash
|
|
env:
|
|
RESOLVE_ET_RESULT: ${{ needs.resolve-et.result }}
|
|
run: |
|
|
if [[ "$RESOLVE_ET_RESULT" != "success" || -z "$ET_BIN_RELEASE" ]]; then
|
|
echo "::error::Bundled et-client release was not resolved for this package build."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Node
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
|
|
- name: Install deps
|
|
run: npm ci
|
|
|
|
- name: Install pacman packaging dependencies
|
|
run: sudo apt-get update && sudo apt-get install -y libarchive-tools
|
|
|
|
- name: Set version
|
|
shell: bash
|
|
run: |
|
|
# See matrix job's Set version step for the strict-semver
|
|
# rationale; identical logic, duplicated because the Linux
|
|
# legs are standalone jobs.
|
|
if [[ "$GITHUB_REF" =~ $STRICT_VERSION_REF_RE ]]; then
|
|
VERSION="${GITHUB_REF_NAME#v}"
|
|
else
|
|
VERSION="0.0.0-sha-${GITHUB_SHA:0:7}"
|
|
fi
|
|
echo "Setting version to ${VERSION}"
|
|
npm pkg set version="${VERSION}"
|
|
|
|
- name: Prepare node-pty Linux runtime
|
|
env:
|
|
npm_config_arch: x64
|
|
run: bash scripts/ensure-node-pty-linux.sh prepare x64
|
|
|
|
- name: Fetch bundled mosh-client
|
|
if: env.BUNDLE_MOSH == 'true'
|
|
run: npm run fetch:mosh -- --platform=linux --arch=x64
|
|
|
|
- name: Fetch bundled et-client
|
|
if: env.BUNDLE_ET == 'true'
|
|
run: npm run fetch:et -- --platform=linux --arch=x64
|
|
|
|
- name: Build package
|
|
env:
|
|
npm_config_arch: x64
|
|
ELECTRON_BUILDER_PUBLISH: "never"
|
|
run: npm run pack:linux-x64
|
|
|
|
- name: Verify packaged node-pty Linux runtime
|
|
run: bash scripts/ensure-node-pty-linux.sh verify x64
|
|
|
|
- name: Verify packaged deb artifact
|
|
run: bash scripts/verify-linux-deb-artifact.sh amd64
|
|
|
|
- name: Upload artifacts
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: netcatty-linux-x64
|
|
path: |
|
|
release/*.AppImage
|
|
release/*.deb
|
|
release/*.rpm
|
|
release/*.pacman
|
|
release/*.yml
|
|
release/*.blockmap
|
|
if-no-files-found: ignore
|
|
|
|
# Dedicated job for Linux ARM64 — builds inside Debian Bullseye (GLIBC 2.31)
|
|
# to ensure compatibility with older distros like UOS/Deepin (GLIBC 2.28).
|
|
# Key: GLIBC < 2.34 avoids the libpthread-merge symbol requirement.
|
|
build-linux-arm64:
|
|
name: ${{ needs.dedupe.outputs.skip_heavy_ci == 'true' && 'deduped build-linux-arm64' || 'build-linux-arm64' }}
|
|
needs: [dedupe, resolve-mosh, resolve-et]
|
|
if: |
|
|
always()
|
|
&& needs.dedupe.result == 'success'
|
|
&& needs.dedupe.outputs.skip_heavy_ci != 'true'
|
|
runs-on: ubuntu-24.04-arm
|
|
container:
|
|
image: debian:bullseye
|
|
env:
|
|
MOSH_BIN_RELEASE: ${{ needs.resolve-mosh.outputs.mosh_bin_release }}
|
|
ET_BIN_RELEASE: ${{ needs.resolve-et.outputs.et_bin_release }}
|
|
npm_config_arch: arm64
|
|
npm_config_target_arch: arm64
|
|
VITE_SYNC_GITHUB_CLIENT_ID: ${{ secrets.VITE_SYNC_GITHUB_CLIENT_ID }}
|
|
VITE_SYNC_GOOGLE_CLIENT_ID: ${{ secrets.VITE_SYNC_GOOGLE_CLIENT_ID }}
|
|
VITE_SYNC_GOOGLE_CLIENT_SECRET: ${{ secrets.VITE_SYNC_GOOGLE_CLIENT_SECRET }}
|
|
VITE_SYNC_ONEDRIVE_CLIENT_ID: ${{ secrets.VITE_SYNC_ONEDRIVE_CLIENT_ID }}
|
|
steps:
|
|
- name: Validate bundled mosh-client release
|
|
if: env.BUNDLE_MOSH == 'true'
|
|
shell: bash
|
|
env:
|
|
RESOLVE_MOSH_RESULT: ${{ needs.resolve-mosh.result }}
|
|
run: |
|
|
if [[ "$RESOLVE_MOSH_RESULT" != "success" || -z "$MOSH_BIN_RELEASE" ]]; then
|
|
echo "::error::Bundled mosh-client release was not resolved for this package build."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Validate bundled et-client release
|
|
if: env.BUNDLE_ET == 'true'
|
|
shell: bash
|
|
env:
|
|
RESOLVE_ET_RESULT: ${{ needs.resolve-et.result }}
|
|
run: |
|
|
if [[ "$RESOLVE_ET_RESULT" != "success" || -z "$ET_BIN_RELEASE" ]]; then
|
|
echo "::error::Bundled et-client release was not resolved for this package build."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Install build dependencies
|
|
run: |
|
|
apt-get update
|
|
apt-get install -y curl build-essential python3 git libfuse2 file rpm \
|
|
libarchive-tools \
|
|
libglib2.0-0 libgtk-3-0 libnss3 libxss1 libxtst6 libasound2 \
|
|
libatk-bridge2.0-0 libdrm2 libgbm1 libx11-xcb1 libxcb-dri3-0
|
|
curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
|
|
apt-get install -y nodejs
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install deps
|
|
run: npm ci
|
|
|
|
- name: Set version
|
|
shell: bash
|
|
run: |
|
|
# See matrix job's Set version step for the strict-semver
|
|
# rationale; identical logic, duplicated because the Linux
|
|
# legs are standalone jobs.
|
|
if [[ "$GITHUB_REF" =~ $STRICT_VERSION_REF_RE ]]; then
|
|
VERSION="${GITHUB_REF_NAME#v}"
|
|
else
|
|
VERSION="0.0.0-sha-${GITHUB_SHA:0:7}"
|
|
fi
|
|
echo "Setting version to ${VERSION}"
|
|
npm pkg set version="${VERSION}"
|
|
|
|
- name: Prepare node-pty Linux runtime
|
|
env:
|
|
npm_config_arch: arm64
|
|
run: bash scripts/ensure-node-pty-linux.sh prepare arm64
|
|
|
|
- name: Fetch bundled mosh-client
|
|
if: env.BUNDLE_MOSH == 'true'
|
|
run: npm run fetch:mosh -- --platform=linux --arch=arm64
|
|
|
|
- name: Fetch bundled et-client
|
|
if: env.BUNDLE_ET == 'true'
|
|
run: npm run fetch:et -- --platform=linux --arch=arm64
|
|
|
|
- name: Build package
|
|
env:
|
|
npm_config_arch: arm64
|
|
ELECTRON_BUILDER_PUBLISH: "never"
|
|
run: npm run pack:linux-arm64
|
|
|
|
- name: Verify packaged node-pty Linux runtime
|
|
run: bash scripts/ensure-node-pty-linux.sh verify arm64
|
|
|
|
- name: Verify packaged deb artifact
|
|
run: bash scripts/verify-linux-deb-artifact.sh arm64
|
|
|
|
- name: Upload artifacts
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: netcatty-linux-arm64
|
|
path: |
|
|
release/*.AppImage
|
|
release/*.deb
|
|
release/*.rpm
|
|
release/*.pacman
|
|
release/*.yml
|
|
release/*.blockmap
|
|
if-no-files-found: ignore
|
|
|
|
release:
|
|
name: release
|
|
runs-on: ubuntu-latest
|
|
needs: [build, build-linux-x64, build-linux-arm64]
|
|
# Only release on a strict v<MAJOR>.<MINOR>.<PATCH>[-pre] tag.
|
|
# Manual workflow_dispatch can publish only when it is run from one
|
|
# of those tags. PRs and branch pushes skip this job.
|
|
if: |
|
|
startsWith(github.ref, 'refs/tags/v')
|
|
&& (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.publish_release))
|
|
permissions:
|
|
contents: write
|
|
actions: read
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Validate release tag
|
|
shell: bash
|
|
run: |
|
|
if [[ ! "$GITHUB_REF" =~ $STRICT_VERSION_REF_RE ]]; then
|
|
echo "::error::Release tags must be v<MAJOR>.<MINOR>.<PATCH> or v<MAJOR>.<MINOR>.<PATCH>-<prerelease>."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Download artifacts
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
path: artifacts
|
|
merge-multiple: true
|
|
|
|
- name: List artifacts
|
|
run: ls -la artifacts/
|
|
|
|
- name: Verify update metadata files
|
|
run: |
|
|
missing=0
|
|
for f in latest-mac.yml latest.yml latest-linux.yml latest-linux-arm64.yml; do
|
|
if [ ! -f "artifacts/$f" ]; then
|
|
echo "::warning::Missing $f in merged artifacts, attempting recovery..."
|
|
missing=1
|
|
fi
|
|
done
|
|
if [ "$missing" = "1" ]; then
|
|
echo "Re-downloading individual artifacts to recover missing files..."
|
|
for name in netcatty-macos netcatty-windows netcatty-linux-x64 netcatty-linux-arm64; do
|
|
tmpdir="/tmp/artifact-${name}"
|
|
gh run download ${{ github.run_id }} --name "${name}" --dir "${tmpdir}" 2>/dev/null || true
|
|
if [ -d "${tmpdir}" ]; then
|
|
for yml in "${tmpdir}"/latest*.yml; do
|
|
[ -f "$yml" ] && cp -v "$yml" artifacts/
|
|
done
|
|
fi
|
|
done
|
|
echo "After recovery:"
|
|
ls -la artifacts/*.yml
|
|
fi
|
|
# Final check — fail if any update yml is still missing
|
|
for f in latest-mac.yml latest.yml latest-linux.yml latest-linux-arm64.yml; do
|
|
if [ ! -f "artifacts/$f" ]; then
|
|
echo "::error::$f is still missing after recovery attempt"
|
|
exit 1
|
|
fi
|
|
done
|
|
echo "All update metadata files present."
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Verify downloaded Linux amd64 deb artifact
|
|
run: |
|
|
deb_file="$(find artifacts -maxdepth 1 -type f -name '*-linux-amd64.deb' -print | sort | head -n 1)"
|
|
test -n "${deb_file}"
|
|
bash scripts/verify-linux-deb-artifact.sh amd64 "${deb_file}"
|
|
|
|
- name: Verify downloaded Linux arm64 deb artifact metadata
|
|
env:
|
|
VERIFY_LOAD: "0"
|
|
run: |
|
|
deb_file="$(find artifacts -maxdepth 1 -type f -name '*-linux-arm64.deb' -print | sort | head -n 1)"
|
|
test -n "${deb_file}"
|
|
bash scripts/verify-linux-deb-artifact.sh arm64 "${deb_file}"
|
|
|
|
- name: Generate Release Body
|
|
run: node .github/scripts/generate-release-note.js
|
|
env:
|
|
GITHUB_REF_NAME: ${{ github.ref_name }}
|
|
GITHUB_REPOSITORY: ${{ github.repository }}
|
|
GITHUB_SHA: ${{ github.sha }}
|
|
|
|
- name: Create GitHub Release
|
|
uses: softprops/action-gh-release@v2
|
|
with:
|
|
body_path: release_notes.md
|
|
prerelease: ${{ contains(github.ref_name, '-') }}
|
|
files: |
|
|
artifacts/*.dmg
|
|
artifacts/*.zip
|
|
artifacts/*.exe
|
|
artifacts/*.AppImage
|
|
artifacts/*.deb
|
|
artifacts/*.rpm
|
|
artifacts/*.pacman
|
|
artifacts/*.yml
|
|
artifacts/*.blockmap
|
|
generate_release_notes: true
|
|
fail_on_unmatched_files: false
|
|
token: ${{ secrets.RELEASE_TOKEN }}
|
|
|
|
homebrew-tap:
|
|
name: bump homebrew tap
|
|
runs-on: ubuntu-latest
|
|
needs: release
|
|
# Only stable release tags update the Cask. Prerelease tags
|
|
# (e.g. v1.2.0-rc.1) are skipped so brew users stay on stable.
|
|
if: |
|
|
startsWith(github.ref, 'refs/tags/v')
|
|
&& !contains(github.ref_name, '-')
|
|
&& (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.publish_release))
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Download macOS artifacts
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: netcatty-macos
|
|
path: artifacts/
|
|
|
|
- name: Bump Cask in binaricat/homebrew-netcatty
|
|
env:
|
|
HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
|
|
ARTIFACTS_DIR: artifacts
|
|
run: |
|
|
# Strip the leading "v" — Cask version is plain semver.
|
|
VERSION="${GITHUB_REF_NAME#v}"
|
|
export VERSION
|
|
bash .github/scripts/bump-homebrew-cask.sh
|